xmrig | 6ac111b80764224914ca4fd2ab59675008839efc667403dd1dc395e7b7cf5c37

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
Size 1.9MB
Sample261030-ncppmsysds
SHA256 6ac111b80764224914ca4fd2ab59675008839efc667403dd1dc395e7b7cf5c37
MD5 05578132aaacbf454a890276aabc1976
SHA1 6b5396f4c584b28bfc1fa293ed440f44f3e095f6
SHA512 eb49612de41ccb259ea449bbc625f3087181343a09604b5225efe7206c5f90cbe6f0dc15b9b4f8b03f759404afd17f18b4f8ec42e933b6a88791d497b851b229
SSDEEP 49152:nNZCWOLT4erGKZmGK2MtEND+AyA7FvjM:NwnLTbGKAo+fK9
TLSH
T15B957C1667F95128F1F33B71EEB992645A777C71AE3AC50E6280025E0DB4E90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery xmrig miner persistence privilege_escalation trojan

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d00000001c4cb-111.dat	family_xmrig
behavioral2/files/0x000d00000001c4cb-111.dat	xmrig

Downloads MZ/PE file 2 IoCs

flow	pid	Process
20	4924	Process not Found
11	408	240718109.tmp

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MicrosoftEdgeUpdateSvcsB8525FE6\ImagePath = "C:\\ProgramData\\2b971ed546ee0a39\\FD3AFA8AB8525FE6\\FD3AFA8AB8525FE6.exe"	jqvjptbo.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
408	240718109.tmp
4228	jqvjptbo.exe
5256	AdobeARMHelper.exe

Loads dropped DLL 3 IoCs

pid	Process
3540	Process not Found
2996	Process not Found
600	Process not Found

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup	AdobeARM.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	240718109.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	240718109.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARMHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\ = "COM Surrogate Module"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32\ = "C:\\ProgramData\\2b971ed546ee0a39\\FD3AFA8AB8525FE6\\FD3AFA8AB8525FE6.dll"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\AppID = "{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}\DllSurrogate	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}\DllSurrogate	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\ = "COM Surrogate Module"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32\ = "C:\\ProgramData\\2b971ed546ee0a39\\FD3AFA8AB8525FE6\\FD3AFA8AB8525FE6.dll"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32\ThreadingModel = "Both"	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\AppID = "{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}"	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E22-2F3A-4B4C-8D6E-0F1A2B3C4D32}	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C12-1D2E-4F3A-9B5C-7D8E9F0A1B23}\InprocServer32	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}\DllSurrogate	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\AppID = "{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32\ThreadingModel = "Both"	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E21-2F3A-4B4C-8D6E-0F1A2B3C4D31}	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C11-1D2E-4F3A-9B5C-7D8E9F0A1B22}\InprocServer32\ThreadingModel = "Both"	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C9D0E23-2F3A-4B4C-8D6E-0F1A2B3C4D33}	jqvjptbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\ = "COM Surrogate Module"	jqvjptbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A6B8C10-1D2E-4F3A-9B5C-7D8E9F0A1B21}\InprocServer32\ = "C:\\ProgramData\\2b971ed546ee0a39\\FD3AFA8AB8525FE6\\FD3AFA8AB8525FE6.dll"	jqvjptbo.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe
5256	AdobeARMHelper.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4164	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4164	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
5084	AdobeARM.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 408	4164	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe	91
PID 408 wrote to memory of 4228	408	240718109.tmp	92
PID 4164 wrote to memory of 5960	4164	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe	97
PID 4164 wrote to memory of 5256	4164	2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe	98
PID 5256 wrote to memory of 5084	5256	AdobeARMHelper.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_05578132aaacbf454a890276aabc1976_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Roaming\240718109.tmp
  "C:\Users\Admin\AppData\Roaming\240718109.tmp"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Users\Admin\AppData\Local\Temp\jqvjptbo.exe
    "C:\Users\Admin\AppData\Local\Temp\jqvjptbo.exe"
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Modifies registry class
    PID:4228
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
  2⤵
  PID:5960
- C:\ProgramData\Adobe\ARM\S\26080\AdobeARMHelper.exe
  "C:\ProgramData\Adobe\ARM\S\26080\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\26080" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\26080" /MODE:3 /PRODUCT:{291AA914-A987-4CE9-BD63-AC0A92D435E5} /VERSION:19.0 /LANG:ENU
    3⤵
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FD3AFA8AB8525FE6.dll

Path C:\ProgramData\2b971ed546ee0a39\FD3AFA8AB8525FE6\FD3AFA8AB8525FE6.dll
Size 3.6MB
SHA256 41a326b73e5366b72ef3cf64da5cc0380ee74b0679a8252be0c38325d69aecd1
MD5 c960f1429e44b8404c84167517dc3b38
SHA1 3c313d0a8db9da5468709d41572b835eb95fa3d2
SHA512 c542ff27527e9298b3d926dcdd26ae951380a183feba86b70a043d407ec49408c0ed5c8a59baaa070846acecdf79ab5d6a4864cd560cac03ddd4086a903ef88e
SSDEEP 98304:QXkdrU/PAU0UuNYYYYYYYYYYYYYYYYEmYYYYYYYYYYYYYYYYYYYYYYYYYPAbBIH:QXkyaUOYYYYYYYYYYYYYYYYEmYYYYYYI
TLSH
T1DF068D16F54240B8C09AC4B8574F7A57F621748E4B69B8EF27A487283E67BF05B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 102B
SHA256 e1be6c6777630139171e4e3e74eaf0f8c0ea3a9fb92e1c76b64fc2ff18a8f1a6
MD5 c42592fd019ec4a186471c670ded3b4f
SHA1 2d5a5b980279b0305441b007778a31c18e84cfb7
SHA512 dc22dbfd7fd36284002bcaa73c2224d42afa850123dedac16c37ac48abddebf6d0c7db1d02793dcc9553d226de60a2cad8075a03be7efb4caa29e92157bb36d5
TLSH
T172B0125313D54C10F4101801CDF444337F2270C0680AC00CC0D1111744F0CC0CE622AF
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 824B
SHA256 c62557ca2d044a3b9ebd39042dcf529c783de02b64e466462aa6cb35d24135a9
MD5 730cdc49a49dc278867956cc11e8fad3
SHA1 4cf2bf16c29ae4538ba552700533463575edde28
SHA512 d9b58266132179c39e62a84ad80f32dd3836310b09c2c7b231137a7c70a6c343994466b0579248878f626fa849b3cea3ccbbe7a10c6967bec922241904f215ee
TLSH
T17C019A831AE91520F1B21F44DFF994735B337CA35C2DC86C90E8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 1KB
SHA256 076339ad65455f7dd94895c489b8718f4ff3bca622b6d233d5e1c42aa6ef6b28
MD5 b794c453722ff5695811f77023b078ff
SHA1 dba17cd01aa65fc6285b14aaef4b43feea8744e0
SHA512 433a5ef8bdbc4126d89c00d28b3e7590f68ff5903ca831838b7c6797d49652f95a1d4feb4215b7b093aa8e411454bb86717dd7719a8996d370239576f4b7699c
TLSH
T164219A832AE90164F5B35F54EFF994735B323CE22D19C86C80D8124E8CF1A90D5B27AB
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARMHelper.exe

Path C:\ProgramData\Adobe\ARM\S\26080\AdobeARMHelper.exe
Size 413KB
SHA256 fd115ae8ebd2f37cf1ef72f75242206cf1331c7cb258305011302e981137ee5e
MD5 522026a14d6bc781d2a15c665e454310
SHA1 9451a39108326ba578793b1feb62f23a02bce916
SHA512 4e4eb2f582c8590899a0ada6133b705d13775f60818f1ff4f9bb35e40e09d6570af4f7ac4c80b525b445a03702ca0f3a9867a93080f90697d8be668e2abe2fe7
SSDEEP 6144:q/6JSQsSVWSLjX2PxPNMRyfn7LzPdKblt0K+HAfh0v8axsbQuXYvr6yIl2:u6dVWnxlMSn7nFKbltn+Ch/m6X2
TLSH
T1DE947C1037D0C036F1B329768ABFD728556DB9715F6881CFA3C8166E5EB06E0AA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 553585c12d481f55d436b51a0e5bb4cc758527496c6b1c1e7850e3c03d5b2cf9
MD5 626cb7109235b0b98dde7f1a01ed4a3e
SHA1 197cfed7730fa2c0edc499a3997acde36abd37f7
SHA512 ef3223203bd384a90cdf11dcecc571294d52201dbc17df2bf91a959df7ec34c193df242d2fe393b474aa0924cec5b867976ee67566c5dea1c7201fa165ff65f2
TLSH
T122F0DC372DB930E1A91904184EA95F00319284ED5EDB46B2247749ED1EAB1E9202B808
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 727B
SHA256 a653d4f32662894bd7d7e80210d90b6e2301d0ab37cd1975eda33df8cc484dfd
MD5 27e18ad446dadf231a1d4730fdbc2693
SHA1 c59fcc1c8e738063d080225a98132b8fa82b35d0
SHA512 c6cc1ad91d564df52d4aaa634bc4b365d775ed3daf29acf23b06b5296561b618d698428b31bb07fcc420df1ae2c256ec963475241e5b418edf33eed6c961106f
TLSH
T15B014903FE283DC53EDDC9796666837B6B8691B619C9CD07607901ACD3C06341505998
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 727B
SHA256 256a0b16bbeabcc80aee30479b34e435c75ac60edd7187feac4046879709a361
MD5 27e44521de6111600ce4c63fb365a238
SHA1 b699393ce01c0708f0f47d15bdab54cfedd650b7
SHA512 3c73f711582e0c34e82ac533be397552d1703727ef4ab61603a21066aa524950334fcfce7bcf5bab164c7a6913dc45b94fa1cb7ca2b44e8c298e6c16e6cdd778
TLSH
T16901E905D905628B4F029D1213CC358631F4303D281C56067F3AF7CAE6D33911748420
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 2275f4b45440eb1461a5a185438d405110ac9262b0c350386811aa2b2521443a
MD5 f6955f1c5b1107f63a517d8624ba2fa5
SHA1 b138ffa49fe6854c6830f1b0e8f0d445095fb5c5
SHA512 1e47d3f6e7197c68ec1ed4442c850a6fc575fd32727301d72fff717a034a4241c9a2d897ff844918a1d11fee011ffea4d65ae468cb96da568caf93aa207c950d
TLSH
T1B6019412DDCFEE453C4588919FEC23C07DA2CA78D6E4C24530A835C602B93F80C0B990
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 5d19ab928fb68fb76002ec22eda962515e3fed838ba3796dc112e18fa2d91895
MD5 51eadaf4bde2bda25b63e5744c5cd659
SHA1 6489f9776d956165a5ff4a00cd395e7f2dc1bc0a
SHA512 02e39e3193d3d132dd005012ab4f01d4705a15115e2bfe42addcc5cb07d0de2625620aaf3c5212cafa3c064e0c994db47b1b7eb99547296c3d4aa000483040f0
TLSH
T1EEE0203437FA115EF1B05B7803D5A1D59F36F1062D95537D1D81141DE909E004CD2C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05
Size 404B
SHA256 36a4b7a18e35fa9929c982db6e5052d8eaa9301fdeffc544bcf1c6d6d7052ad0
MD5 d409aaf8530f58b0e0eeccdbc58e14dc
SHA1 99a191872e24f45a612733453f77ff77e8a54bba
SHA512 2c3fee1633927fdc179b126bd82d0c2aa7b114f70e99250d4bba923e48226a0d8153c9525df0bb667a5bede032085b46dc0f2b94fdc5be298f84dd1e6ffd00f1
TLSH
T158E0C03032F5015DF2E4D43443EA9D5214D5F1074482C2760150130DAB217C08CF1134
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A
Size 404B
SHA256 23a746a466584347e454f265f76c2b9fe8f7fb14ca0787682bb9b9d988a38898
MD5 c247e12c5f13ed596832f683409f1a25
SHA1 04e4118ea4000405f309df90813c52672329a58b
SHA512 f7861b34bc66682da6e74b048ee942f9e607d9399fdb2fa3fb2050cb2be1c29882c3340299c6a7fba212a05611a0cc6505c8b9a2913a8178dd5c4b105df9786a
TLSH
T147E0C03032F5055FF0B4A43417E75D128489F21A1D86C37E010013159610B004CD6630
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 047de622c7bdc19d2c37dfed8b518df9cf9b4a943b7c485e737fb71cbce72e44
MD5 0af1145627cdec11dada713d8704928f
SHA1 12ac4d531dc15400b2edc59d170595e7d4d90ef6
SHA512 e52dc48ca3f75c1264f90a13c75d1289a5dd7b2b60fb6e5589f0a4893a5d0ad0de67f1bfd59c3090f26f46fc172566991bee3cce34398aca8a60c61d78d47ebe
TLSH
T194E06F3C2AABB01EF090CC3143FAA17B2E69E306184496B90A840308FB0BF005C65EB8
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 2c282147962c2c2ad465bac0aec2f67d4e84fc5c4b8880e1bac99de326ff0b10
MD5 bfddde30fe6618aae4307534e73c9776
SHA1 e73e2aed4295846486d3057e48c5abc8172bf34c
SHA512 2defcbafe1c05d94442ddc7d79339eab3c46d7535f897359e14dd384c313c42e7e1120d3b41ab3c1773abf7bd1159c72c50abeb8fcc1c3e18e43bbe1a737ccc5
TLSH
T12621E141192AC2B6156D22EC2F7D9FAF143C21B0014459F873048FE6BA8FC068F235B4
MD5 SHA1 SHA512 TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 1KB
SHA256 6557db571446d406f11e2a01cafa1488741dad143c6c09ba6094bce2ca9f54de
MD5 59be9bdf545c92ff28d967b5e678e3a3
SHA1 4b890a3fe13a0cafee3f670c1a31cb00daf9547d
SHA512 d3d7307b583131bcae9143b20d17f261004beb3f8da774b19f169bad109a0809bf43e005e99a0a018214f4491cabb45e23ad288bc2202afe1e1f77fcc496f291
TLSH
T1FB31F141192BC1B6156D22EC2F7DAFAA143C21B0024599F873048BE6BA8FC068F275B4
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp718C.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp718C.tmp
Size 5KB
SHA256 b2e41f3d236f5418f702111b610f382663c8893d82d5284462d2133f0e0c0fdf
MD5 38c0245547bc1440fb56c7308c2bb222
SHA1 8ccf6f27b9644fad1c8f13d98e9d680154c8d572
SHA512 78da2e84d0ebb47faec6999320198da63e02f8653a0b0609a16675592ff26b2ecc8de6a3210c31e28b72d6ee340dcdd792207cba96e1ae92b72c07d1d9fec897
SSDEEP 96:HX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yJF46R:3ULc8pq8RuwdmL4pUQrNyH4o
TLSH
T14FC13BA388946C45EC27ED00B4C89A23EDF576591DC0D1C33248C2A58B923973BDE2EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8C2B.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8C2B.tmp
Size 5KB
SHA256 512146b59d21f56f01882290e8b1e93e0553b85435b4d31e4c51d3d9ccd14df5
MD5 8de699a7d8a071e752e129d70525fcc8
SHA1 da6fcbafb68dd579195ff775afcf64f4209ef52a
SHA512 43697eaa55d5b7ca68036110d2bd12e01f6fc45fc7e3d4baf99b1de506170707a4eb801d6460dfcdf491fd58bafa3c93b8aeb5e2b36435e5249a2d7fe6a30be5
SSDEEP 96:PX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yh54pD3D:fULc8pq8RuwdmL4pUQrNyh54pzD
TLSH
T1F8C12CA349907C45ED17ED00B4D8A923FDF2B6952DC1D0C36258C5A58B823973BDE5EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp8D16.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8D16.tmp
Size 3KB
SHA256 dcc9d2695125406282ba990fec39403c44b12964acf51b5e0dc7f2080d714398
MD5 fc2430057cb1be74c788f10c2d4540c8
SHA1 cab67ee8d5191fbf9f25545825e06c1a822af2f2
SHA512 4e2b9709a9e3ca5173abb35816e5a0aebbf2a7aaf971d7f75f3ae66e4a812cbade103baa5016525f5ab83a60c18f8d3c278c90ff83e4afdae419f81673cb5aee
TLSH
T1FC71D8CE0D1A6813ABC7FE8AA1C5E3695C30A3E16AD154CB08BC95824FC6FC51A4901D
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp94A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp94A9.tmp
Size 5KB
SHA256 e6bcbcb70401d63ff0746fcbcc63230269058736f7644151393edfdcec8b8765
MD5 1b7ade3253fc67477dea69ef2147603d
SHA1 b71e8e749a3461c9b37ff2c3d099b1911d9cc6a0
SHA512 0edd5eb1635b1599e50b368cb254c94bf1588acf1d063e89f45fcfd6fa625e33d2c7764d9d00afd53dec2dfb342e9cfe199d256edcff8430ae183d357d4382da
SSDEEP 96:7NLX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yGtDwwBq:RULc8pq8RuwdmL4pUQrNyGewBq
TLSH
T16CC12AB388D06C41AD5BBD11B4C89933ADB272992DC1D0D33258C6A58B913873BDE2ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TmpC542.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpC542.tmp
Size 5KB
SHA256 a86ac1b119a6653e0c3fc24c2c40e44a7bfdc435fd81c4442af9d5526ef64e85
MD5 5bc2d1f7a5fd950dd51547ead6afdabd
SHA1 90f4e48ac87f4eb9dd10f1a80d46a7063f06a7d2
SHA512 45f18bf24c7f1102c17dd30aa205498f27336259ac3869c1d6129609a40385e68d9a2f353e3b13f18f40e7d1d32c4fb31d10f7b2fa204e24e4411183bb749f55
SSDEEP 96:7sX74Lc8pJvjU8RunwXGkmIKBiHJdij9tAz4yT+QE4yQRlOelNMQtU:gULc8pq8RuwdmL4pUQrNyYlOefM/
TLSH
T13DC12AA388D46C05AD17BC04B4C49A23FEB2B2855EC1D1D36258C1A58B913973ADE6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jqvjptbo.exe

Path C:\Users\Admin\AppData\Local\Temp\jqvjptbo.exe
Size 3.8MB
SHA256 6d0bcc54c16636963ce0c53962db2ab42815be0161b925e660031fabfe04b7d7
MD5 3fca0c09397f8322dfe4e0b49cb69e13
SHA1 3e8056f0cd1c01cba90f78cb322049db3c0bf31c
SHA512 81afbb4bf925e2f8a2746ef43b5090dbdcf67120a7687f0fa2bdc88d410f1362a5c85b304fa8d6386747a2945be5362b1ca65c54362d2421ab52f959b7e21ae1
SSDEEP 98304:un/+2rD2XiuzWzNbhFVj3hOhY5gNppnq:4/BoDzm33zOjp
TLSH
T1A6163308F7D151F6E6B7C638C65A0501F63AB8024B18ABCF0265F1A82F36AD61D77BD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

240718109.tmp

Path C:\Users\Admin\AppData\Roaming\240718109.tmp
Size 42KB
SHA256 4bb459fa7fb3e451db2ce2f7967484d719f64dd12b8cf9cb1a6d12c54259b401
MD5 c9d67320cb061d60691430f1bad645b1
SHA1 389d7b4609d747cd1d8f0f2379fc3c2998da7486
SHA512 a94ae5605e2fff0c5f6f391486436ef2520d7e1b151d6ee41f35ad78016d714681b9b23221f0dde0cba8162897e3ca0a99eae7a019d7edc52c3c7bc1a2354cbb
SSDEEP 768:Ua9q/poJBwZy+v6vWBdj+ggdOMUzYmMk3hPUhFzrgpBDEpsXNQo51Vy4bj/byiRX:T9quJBwZy+v6vWBdj+ggdOMUzYm6hRr0
TLSH
T1F813C33BB196D1B2C73780B28601F71EFEA73F1760B1461E2785774E6A33A819A35607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4164-6-0x0000000001380000-0x0000000001405000-memory.dmp

Download

memory/4164-7-0x0000000001380000-0x0000000001405000-memory.dmp

Download

memory/4164-0-0x0000000001380000-0x0000000001405000-memory.dmp

Download

memory/4164-5-0x0000000002BD0000-0x0000000002D7B000-memory.dmp

Download